Machine learning has been moving into credit decisioning for years, from application scoring and limit setting to early-warning systems and collections. Gradient-boosted trees and other non-linear models can extract more signal from bureau, transaction and alternative data than traditional scorecards. What has held many lenders back is not the mathematics but the governance: how to validate, explain and monitor models that are harder to interpret, and how to satisfy regulators and consumers that decisions are fair.
In 2026, the regulatory frame for that governance shifted on both sides of the Atlantic. In April, US banking agencies replaced SR 11-7, the model risk management guidance that had shaped bank practice since 2011, with new risk-based guidance known as SR 26-2. In July, the EU’s Digital Omnibus on AI entered into force, pushing the application date for high-risk AI obligations, including AI used for creditworthiness assessment, to December 2, 2027. This article explains what changed and sets out a practical operating model for machine learning in credit decisions that works under both regimes.
SR 26-2: What Replaced SR 11-7
On April 17, 2026, the Federal Reserve, the OCC and the FDIC issued revised interagency guidance on model risk management. It supersedes SR 11-7 and SR 21-8, the 2021 statement on model risk for Bank Secrecy Act and anti-money laundering systems. According to the Federal Reserve’s cover letter, the guidance is expected to be most relevant to banking organizations with more than $30 billion in total assets, compared with the roughly $1 billion threshold that law firm Orrick notes applied to the prior guidance.
Several changes matter for credit model owners:
- A narrower model definition. A model is now described as a complex quantitative method applying statistical, economic or financial theories to inputs. Simple arithmetic, spreadsheets with basic calculations and deterministic rule-based processes are excluded.
- Explicitly risk-based rigor. Model risk combines inherent risk (complexity, assumptions, data quality) with materiality, which considers both exposure (how significant the model is to business decisions) and purpose. Low-risk, low-materiality models can receive lighter oversight.
- Validation retained but streamlined. Conceptual soundness, outcomes analysis and ongoing monitoring remain the core components, but detailed prescriptions have been removed. The quality of validation is judged by the rigor and effectiveness of the review rather than organizational structure alone.
- Use before validation in urgent cases. The guidance acknowledges that a model may be used before validation is complete when there is urgent need, with limits on use, stakeholder communication and enhanced monitoring.
- A dedicated third-party section. Banks remain responsible for understanding vendor models, monitoring their performance and documenting any customizations.
- Generative and agentic AI out of scope. A footnote excludes generative and agentic AI as novel and rapidly evolving; banks should manage them through broader risk management and governance. Traditional statistical models and non-generative machine learning models remain in scope.
The agencies also signaled a future request for information on banks’ use of AI. For credit teams, the important point is that machine learning credit models are squarely covered by SR 26-2, and that credit decisioning models will almost always rank high on materiality.
The EU AI Act Timeline for Credit Scoring
Under the EU AI Act, AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are listed in Annex III as high-risk, with a narrow exception for systems used to detect financial fraud. The Digital Omnibus on AI, which entered into force on July 27, 2026, moved the application date for Annex III high-risk obligations from August 2, 2026 to December 2, 2027.
The delay is not a reprieve from the substance. Providers of high-risk systems will need risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy and robustness controls and a conformity assessment. Deployers, such as lenders using a vendor scoring system, have their own obligations, and certain deployers, including those evaluating creditworthiness, must conduct a fundamental rights impact assessment under Article 27. The Omnibus also extended the legal basis for processing special categories of personal data to detect and correct bias to all AI systems, subject to a strict necessity test, which is directly relevant to fairness testing of credit models.
As commentators such as Holistic AI point out, the work needed to comply, including documentation, testing, conformity assessment and post-market monitoring, takes many months. Lenders operating in the EU that treat December 2027 as a starting date rather than a deadline will struggle.
The regulatory calendar moved, but the engineering did not. Explainable, fair and well-monitored credit models take longer to build than the time left before December 2027.
A Unified Governance Model for ML Credit Models
Lenders operating in both the US and the EU should avoid running separate compliance programs. The underlying disciplines (sound design, independent challenge, explainability, fairness and monitoring) are common to both regimes. We recommend a single model lifecycle with jurisdiction-specific evidence packs.
1. Inventory and tiering
Maintain one inventory of credit models and AI systems, including vendor models and decision rules that sit around them. Tier each by materiality and inherent risk under SR 26-2, and flag those that qualify as Annex III high-risk systems in the EU. Remember that a deterministic policy rule may fall outside the US model definition but still matter for fair lending and consumer outcomes.
2. Purpose and design documentation
Start each model with a clear statement of purpose, intended population, decision use and limitations, as SR 26-2 recommends. Document data sources, feature engineering, exclusions and the rationale for model choice, including why a more complex algorithm is justified over a simpler alternative.
3. Data governance
Credit models depend on data that changes over time and across channels. Track lineage, representativeness and quality for training and scoring data. For the EU, this aligns with Article 10 data and data governance requirements; in the US, it supports conceptual soundness and fair lending reviews.
4. Explainability by design
Choose techniques that produce faithful explanations at both global and individual levels. Monotonic constraints, interpretable feature sets and well-tested post-hoc methods such as SHAP values help, but explanations must be validated, not just generated. Individual explanations must support adverse action notices: US lenders must provide specific principal reasons for adverse credit decisions under the Equal Credit Opportunity Act and Regulation B, regardless of model complexity.
5. Fairness testing
Test for disparate outcomes across protected groups, investigate drivers and evaluate less discriminatory alternative models where differences appear. Document the search for alternatives and the business justification for the chosen model. In the EU, the new strict-necessity basis for processing sensitive data can support this work, but it must be carefully scoped with data protection teams.
6. Validation and effective challenge
Validators need the expertise to challenge machine learning techniques, independence sufficient for objectivity and the standing to require changes, which is how SR 26-2 frames effective challenge. Test stability, sensitivity, out-of-time performance, behavior on thin-file and new-to-credit segments and robustness to data drift.
7. Monitoring and human oversight
Monitor discrimination, calibration, population stability, feature drift, override rates and fairness metrics on a defined cadence, with triggers for review. Define when humans review or override decisions, and train them to avoid both rubber-stamping and inconsistent overrides.
Vendor and Third-Party Scoring Models
Many lenders rely on bureau scores, fintech platforms or vendor decision engines. Both regimes place responsibility on the lender. SR 26-2 states that model risk principles still apply when a bank cannot fully validate a third-party model, and that customizations must be documented and evaluated. Under the EU AI Act, the vendor is typically the provider of the high-risk system, but the lender as deployer must use it according to instructions, ensure human oversight, monitor operation and keep logs.
Practical contract and due diligence requirements include:
- Access to development documentation, performance and fairness testing results sufficient to assess conceptual soundness
- Ongoing performance reporting on your own population, not just the vendor’s benchmark data
- Reason code methodology and evidence that reasons are accurate and specific enough for adverse action notices
- Notification of material model changes, retraining or data source changes before they take effect
- For EU deployments, confirmation of the provider’s conformity assessment plan, instructions for use and logging capabilities
Where Generative AI Fits, and Where It Does Not
Generative AI is increasingly used around credit decisions: summarizing financial statements, drafting credit memos, extracting data from documents and assisting collections agents. Because SR 26-2 excludes generative and agentic AI, these uses must be governed under broader risk management frameworks, but that does not mean less control.
- Keep generative AI in assistive roles where a qualified human reviews output before it influences a credit decision
- Validate extraction accuracy against source documents, especially for figures that feed models or covenants
- Log prompts, outputs and reviewer actions so that decisions can be reconstructed
- Avoid using generative models to produce adverse action reasons; reasons must reflect the actual decision drivers of the scoring model
- Assess whether a use case could itself fall within the EU’s high-risk category if it materially influences creditworthiness assessment
Agentic AI deserves particular caution. Agents that can gather documents, query systems and propose decisions could compress underwriting timelines, but an agent that takes actions affecting a credit outcome raises questions of accountability, explainability and control that existing frameworks were not designed for. Until supervisory expectations mature, including through the agencies’ planned request for information on AI, a prudent approach is to restrict agents to preparation and recommendation, keep a human decision-maker accountable and log every step the agent takes.
A Worked Example: Replacing a Consumer Scorecard
Consider a generic consumer lender operating in the US and two EU markets that wants to replace a logistic regression scorecard with a gradient-boosted model using bureau and transaction data. A champion-challenger test shows better rank ordering, particularly for thin-file applicants.
The team tiers the model as high materiality under SR 26-2 and as a high-risk Annex III system in the EU. Developers apply monotonic constraints to key features so that, for example, higher utilization never improves the score, and they remove features that act as close proxies for protected characteristics. Fairness testing reveals an approval-rate gap for one segment; the team evaluates alternative feature sets and selects a version that narrows the gap with only a small loss in predictive power, documenting the trade-off.
Validators challenge the explanation method by checking that reason codes are stable for similar applicants and consistent with the model’s global behavior. The model goes live in the US with enhanced monitoring of approval rates, overrides and drift, while the EU deployment is prepared with technical documentation, a fundamental rights impact assessment and logging aligned with the AI Act. A single evidence repository serves both regulators, avoiding duplicate work.
A 90-Day Action Plan for Credit Risk Leaders
Regulatory change is a good moment to reset model governance. The following sequence can be completed within a quarter and creates a foundation for both SR 26-2 and the AI Act.
- Weeks 1–3: Re-baseline the inventory. Apply the new SR 26-2 model definition to your inventory, identify items that drop out (and decide how they will still be controlled), and flag every credit system that would qualify as high-risk under Annex III.
- Weeks 3–5: Re-tier by materiality. Score each model on inherent risk, exposure and purpose. Expect credit origination, limit management and loss forecasting models to remain in the top tier.
- Weeks 5–8: Gap assessment. For top-tier machine learning models, assess documentation, explainability, fairness testing, monitoring and vendor evidence against both regimes. Prioritize gaps by consumer impact and regulatory exposure.
- Weeks 8–10: Standardize evidence. Create common templates for purpose statements, data lineage, validation reports, fairness analyses and monitoring dashboards that can be reused across jurisdictions.
- Weeks 10–13: Fix the highest-risk gaps. Address reason code accuracy, fairness testing and monitoring triggers first, since these affect consumers today regardless of regulatory deadlines.
A final step is to decide how generative AI tools used around credit processes will be governed, given their exclusion from SR 26-2. Many lenders extend their model governance framework with an AI use policy and a lighter-weight review path, rather than leaving these tools unmanaged.
Pitfalls to Avoid
- Reading SR 26-2’s proportionality as permission to reduce rigor for credit decisioning models, which almost always carry high materiality
- Assuming that tools excluded from the new model definition, such as deterministic decision rules, no longer need controls; they still affect fair lending outcomes
- Treating explanation methods as self-validating; post-hoc explanations can be unstable or misleading without testing
- Relying entirely on vendor assurances for third-party scores without monitoring performance on your own population
- Postponing EU AI Act preparation until 2027, leaving too little time for documentation, conformity assessment and fundamental rights impact assessments
- Running separate US and EU programs that duplicate effort and produce inconsistent evidence
Conclusion
The 2026 changes make the regulatory landscape for credit models more proportionate in the US and give EU lenders more time. Neither change lowers the bar for the models that matter most. Credit decisioning models sit at the top of any materiality ranking, affect consumers directly and are subject to fair lending laws that did not change. Lenders that build a single, disciplined lifecycle for machine learning credit models now, covering documentation, explainability, fairness, validation and monitoring, will capture the performance benefits of better models while staying ready for supervisors in Washington and Brussels alike.
How Hanoi Technology Can Help
Hanoi Technology builds, documents and monitors machine learning credit models with explainability and fairness controls designed for model risk and AI Act reviews.
Further Reading
- SR 26-2: Revised Guidance on Model Risk Management – Federal Reserve
- Agencies Overhaul Model Risk Management Guidance for Banks: Here’s What Changed – Orrick
- SR 26-2 Revised Guide on Model Risk Management – Management Solutions
- EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines – Gibson Dunn
- The EU AI Act’s deadline moved to 2027. Yours didn’t – Holistic AI